Is the simple solution to just open source it?
Why not just open source the client and server apps so we can see how it protects our data.
Its unlikely to be using any proprietary algorithms that might be considered IP.
We could also allow the user to opt out of collection of any fields they are not comfortable sharing.
I think most people are adult enough to make their own decisions about what's appropriate to share.
They can also uninstall the app when they no longer wish to be tracked. It's not compulsory to run it.
We really don't need to nanny everyone for their own good, we need to track COVID19 and find out how it behaves.